Skip to content

Commit 60cd5de

Browse files
DiamondJosephDiamondJoseph
committed
fix: Remove bitnami common chart and refactor deployment configuration
1 parent 2c02fc4 commit 60cd5de

15 files changed

Lines changed: 293 additions & 181 deletions

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
site/
2+
**/charts/*.tgz

‎charts/apps/values.yaml‎

Lines changed: 37 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,50 @@ opa:
1717
targetRevision: HEAD
1818
path: charts/opa
1919
valuesObject:
20-
orgData:
21-
bundlerSecret:
22-
name: token-authorization
23-
key: bearer
24-
orgPolicy:
25-
enabled: true
20+
21+
extraEnvVars:
22+
- name: BUNDLER_BEARER_TOKEN
23+
valueFrom:
24+
secretKeyRef:
25+
name: token-authorization
26+
key: bearer
27+
- name: ISSUER
28+
value: https://authn.diamond.ac.uk/realms/master
29+
2630
autoscaling:
2731
enabled: true
2832
minReplicas: 2
33+
maxReplicas: 10
34+
targetMemoryUtilizationPercentage: 80
35+
2936
ingress:
3037
enabled: true
3138
hosts:
3239
- host: authz.diamond.ac.uk
3340
paths:
3441
- path: /
3542
pathType: Prefix
43+
44+
config:
45+
services:
46+
diamond-bundler:
47+
url: https://authz.diamond.ac.uk
48+
credentials:
49+
bearer:
50+
token: ${BUNDLER_BEARER_TOKEN}
51+
ghcr:
52+
url: https://ghcr.io
53+
type: oci
54+
bundles:
55+
diamond-permissionables:
56+
service: diamond-bundler
57+
resource: bundle.tar.gz
58+
polling:
59+
min_delay_seconds: 10
60+
max_delay_seconds: 60
61+
diamond-policies:
62+
service: ghcr
63+
resource: ghcr.io/zohebshaikh/authz-policy:0.0.19
64+
polling:
65+
min_delay_seconds: 30
66+
max_delay_seconds: 120

‎charts/opa/.gitignore‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎charts/opa/Chart.lock‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎charts/opa/Chart.yaml‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,24 @@
11
apiVersion: v2
22
name: opa
3-
description: An OPA deployment to run alongside applications requiring authorization
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
413
type: application
5-
version: 0.6.5
6-
appVersion: 0.59.0
7-
maintainers:
8-
- name: garryod
9-
email: "garry.o'donnell@diamond.ac.uk"
10-
dependencies:
11-
- name: common
12-
version: 2.23.0
13-
repository: oci://docker.io/bitnamicharts
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.11.0-dev"

‎charts/opa/templates/NOTES.txt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
1. Get the application URL by running these commands:
2+
{{- if .Values.ingress.enabled }}
3+
{{- range $host := .Values.ingress.hosts }}
4+
{{- range .paths }}
5+
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
6+
{{- end }}
7+
{{- end }}
8+
{{- else if contains "NodePort" .Values.service.type }}
9+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "opa.fullname" . }})
10+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
11+
echo http://$NODE_IP:$NODE_PORT
12+
{{- else if contains "LoadBalancer" .Values.service.type }}
13+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
14+
You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "opa.fullname" . }}'
15+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "opa.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
16+
echo http://$SERVICE_IP:{{ .Values.service.port }}
17+
{{- else if contains "ClusterIP" .Values.service.type }}
18+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "opa.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
19+
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
20+
echo "Visit http://127.0.0.1:8080 to use your application"
21+
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
22+
{{- end }}

‎charts/opa/templates/_helpers.tpl‎

Lines changed: 49 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
11
{{/*
2-
Create the tag to be used to pull the chart
2+
Expand the name of the chart.
33
*/}}
4-
{{- define "opa.imageTag" -}}
5-
{{- if .Values.image.tagOverride }}
6-
{{- .Values.image.tagOverride }}
4+
{{- define "opa.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "opa.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
716
{{- else }}
8-
{{- $version := default .Chart.AppVersion .Values.image.version }}
9-
{{- if .Values.image.envoy }}
10-
{{- print $version "-envoy" }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
1120
{{- else }}
12-
{{- $version }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
1322
{{- end }}
1423
{{- end }}
1524
{{- end }}
1625

1726
{{/*
18-
Determine the query port to be used
27+
Create chart name and version as used by the chart label.
1928
*/}}
20-
{{- define "opa.queryPort" -}}
21-
{{- if .Values.portOverride }}
22-
{{- .Values.image.portOverride }}
23-
{{- else }}
24-
{{- if .Values.image.envoy }}
25-
{{- 9191 }}
26-
{{- else }}
27-
{{- 8181 }}
29+
{{- define "opa.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "opa.labels" -}}
37+
helm.sh/chart: {{ include "opa.chart" . }}
38+
{{ include "opa.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
2841
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "opa.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "opa.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "opa.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "opa.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
2961
{{- end }}
3062
{{- end }}

‎charts/opa/templates/deployment.yaml‎

Lines changed: 45 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,91 @@
11
apiVersion: apps/v1
22
kind: Deployment
33
metadata:
4-
name: {{ include "common.names.fullname" . }}
4+
name: {{ include "opa.fullname" . }}
55
labels:
6-
{{- include "common.labels.standard" . | nindent 4 }}
6+
{{- include "opa.labels" . | nindent 4 }}
77
spec:
88
{{- if not .Values.autoscaling.enabled }}
99
replicas: {{ .Values.replicaCount }}
1010
{{- end }}
1111
selector:
1212
matchLabels:
13-
{{- include "common.labels.matchLabels" . | nindent 6 }}
13+
{{- include "opa.selectorLabels" . | nindent 6 }}
1414
template:
1515
metadata:
16+
{{- with .Values.podAnnotations }}
1617
annotations:
1718
checksum/config: {{ include (print $.Template.BasePath "/opa-config.yaml") . | sha256sum }}
18-
{{- with .Values.podAnnotations }}
19-
{{- toYaml . | nindent 8 }}
20-
{{- end }}
19+
{{- toYaml . | nindent 8 }}
20+
{{- end }}
2121
labels:
22-
{{- include "common.labels.matchLabels" . | nindent 8 }}
22+
{{- include "opa.labels" . | nindent 8 }}
23+
{{- with .Values.podLabels }}
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
2326
spec:
2427
{{- with .Values.imagePullSecrets }}
2528
imagePullSecrets:
2629
{{- toYaml . | nindent 8 }}
2730
{{- end }}
28-
{{- if .Values.serviceAccount.create }}
29-
serviceAccountName: {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
30-
{{- else }}
31-
serviceAccountName: {{ default "default" .Values.serviceAccount.name }}
32-
{{- end }}
31+
serviceAccountName: {{ include "opa.serviceAccountName" . }}
32+
{{- with .Values.podSecurityContext }}
3333
securityContext:
34-
{{- toYaml .Values.podSecurityContext | nindent 8 }}
34+
{{- toYaml . | nindent 8 }}
35+
{{- end }}
3536
containers:
36-
- name: opa
37+
- name: {{ .Chart.Name }}
38+
{{- with .Values.securityContext }}
3739
securityContext:
38-
{{- toYaml .Values.securityContext | nindent 12 }}
39-
image: "{{ .Values.image.repository }}:{{ include "opa.imageTag" . }}"
40+
{{- toYaml . | nindent 12 }}
41+
{{- end }}
42+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
4043
imagePullPolicy: {{ .Values.image.pullPolicy }}
4144
args:
4245
- run
4346
- --server
4447
- --diagnostic-addr
4548
- 0.0.0.0:8282
49+
- --addr
50+
- 0.0.0.0:8181
4651
- --config-file
4752
- /etc/opa-config/config.yaml
4853
- --log-level
49-
- {{ .Values.logLevel }}
50-
{{- if .Values.envOverride }}
51-
env:
52-
{{- .Values.envOverride | toYaml | nindent 12 }}
53-
{{- else if or .Values.orgData.bundlerSecret .Values.extraEnv }}
54-
env:
55-
{{- if and .Values.orgData.enabled .Values.orgData.bundlerSecret }}
56-
- name: BUNDLER_BEARER_TOKEN
57-
valueFrom:
58-
secretKeyRef:
59-
name: {{ tpl .Values.orgData.bundlerSecret.name . }}
60-
key: {{ .Values.orgData.bundlerSecret.key }}
61-
{{- end -}}
62-
{{- if .Values.orgPolicy.enabled }}
63-
{{- with .Values.orgPolicy.issuer }}
64-
- name: ISSUER
65-
value: {{ . }}
66-
{{- end }}
67-
{{- end }}
68-
{{- if .Values.extraEnv }}
69-
{{- .Values.extraEnv | toYaml | nindent 12 }}
70-
{{- end }}
71-
{{- end }}
72-
volumeMounts:
73-
- name: opa-config
74-
mountPath: /etc/opa-config
54+
- {{ default "info" .Values.logLevel }}
7555
ports:
76-
- name: query
77-
containerPort: {{ include "opa.queryPort" . }}
56+
- name: http
57+
containerPort: {{ .Values.service.port }}
7858
protocol: TCP
7959
- name: diagnostic
8060
containerPort: 8282
8161
protocol: TCP
62+
{{- with .Values.livenessProbe }}
8263
livenessProbe:
83-
httpGet:
84-
path: /health
85-
port: diagnostic
64+
{{- toYaml . | nindent 12 }}
65+
{{- end }}
66+
{{- with .Values.readinessProbe }}
8667
readinessProbe:
87-
httpGet:
88-
path: /health
89-
port: diagnostic
68+
{{- toYaml . | nindent 12 }}
69+
{{- end }}
70+
{{- with .Values.resources }}
9071
resources:
91-
{{- toYaml .Values.resources | nindent 12 }}
72+
{{- toYaml . | nindent 12 }}
73+
{{- end }}
74+
volumeMounts:
75+
- name: opa-config
76+
mountPath: /etc/opa-config
77+
{{- with .Values.volumeMounts }}
78+
{{- toYaml . | nindent 12 }}
79+
{{- end }}
80+
env:
81+
{{- toYaml .Values.extraEnvVars | nindent 12 }}
9282
volumes:
9383
- name: opa-config
9484
configMap:
95-
name: opa-config
85+
name: opa-config
86+
{{- with .Values.volumes }}
87+
{{- toYaml . | nindent 8 }}
88+
{{- end }}
9689
{{- with .Values.nodeSelector }}
9790
nodeSelector:
9891
{{- toYaml . | nindent 8 }}

‎charts/opa/templates/hpa.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1-
{{- if .Values.autoscaling.enabled -}}
1+
{{- if .Values.autoscaling.enabled }}
22
apiVersion: autoscaling/v2
33
kind: HorizontalPodAutoscaler
44
metadata:
5-
name: {{ include "common.names.fullname" . }}
5+
name: {{ include "opa.fullname" . }}
66
labels:
7-
{{- include "common.labels.standard" . | nindent 4 }}
7+
{{- include "opa.labels" . | nindent 4 }}
88
spec:
99
scaleTargetRef:
1010
apiVersion: apps/v1
1111
kind: Deployment
12-
name: {{ include "common.names.fullname" . }}
12+
name: {{ include "opa.fullname" . }}
1313
minReplicas: {{ .Values.autoscaling.minReplicas }}
1414
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
1515
metrics:

0 commit comments

Comments
 (0)